VulnerabilityModified
CVE-2023-35867
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation.
MEDIUM 5.9EPSS 0.56%
Does this matter?
Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own.
Description
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.56% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-703
- Affected
- bosch/building integration system video engine · bosch/bosch video management system · bosch/video management system viewer · bosch/configuration manager · bosch/divar ip 7000 r2 firmware · bosch/divar ip all-in-one 4000 firmware · bosch/divar ip all-in-one 5000 firmware · bosch/divar ip all-in-one 6000 firmware · bosch/divar ip all-in-one 7000 firmware · bosch/divar ip all-in-one 7000 r3 firmware · bosch/intelligent insights · bosch/ onvif camera event driver tool · bosch/project assistant · bosch/video security client
- Source
- psirt@bosch.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.